podman-container-tools/podman · critical

cannot sigdelset(SIGCHLD): %m\n

Error message

cannot sigdelset(SIGCHLD): %m\n

What it means

Printed in the child branch of reexec_in_user_namespace() in pkg/rootless/rootless_linux.c:1344 after a successful sigfillset(). sigdelset(&sigset, SIGCHLD) is removing SIGCHLD from the just-filled signal set so the child can still receive child-exit notifications; the only documented failure is EINVAL for an invalid signum, and SIGCHLD is always valid on Linux. Hitting this therefore indicates a corrupted sigset_t or a broken libc, not a normal runtime condition.

Source

Thrown at pkg/rootless/rootless_linux.c:1344

              for (f = 3; f < num_fds + 3; f++)
                if (is_fd_inherited (f))
                  close (f);
            }
          unsetenv ("LISTEN_PID");
          unsetenv ("LISTEN_FDS");
          unsetenv ("LISTEN_FDNAMES");
        }
      return pid;
    }

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  argv = get_cmd_line_args (NULL);
  if (argv == NULL)
    {
      fprintf (stderr, "cannot read argv: %m\n");
      _exit (EXIT_FAILURE);

View on GitHub (pinned to a2409076ef)

Solutions

1. Rule out memory corruption: rebuild podman from clean sources and run under valgrind/ASan to see if the sigset_t was overwritten.
2. Verify the platform libc is sane: run a tiny C program calling sigfillset()+sigdelset(&s,SIGCHLD) to check it returns 0 on that system.
3. If it reproduces on a supported distro, report it as a podman/github issue with podman info, glibc version, and architecture.
4. As an immediate workaround for a broken environment, run podman inside a container or chroot with a known-good glibc.

# sanity-check signal primitives in the target environment before relying on rootless podman
# cc -o sigtest sigtest.c: sigfillset(&s); if (sigdelset(&s,SIGCHLD)!=0) abort();
command -v podman >/dev/null || { echo 'podman missing'; exit 1; }
ldd --version | head -1   # known-good glibc/musl release for your distro

When it happens

Trigger: Calling reexec_in_user_namespace (rootless podman startup, podman unshare, socket-activated rootless podman) on a system where sigfillset() succeeded but the subsequent sigdelset() of the fixed constant SIGCHLD returns -1 — practically only memory corruption of the stack sigset variable or a glibc/platform bug.

Common situations: Never observed in normal operation; would appear only with a broken/mismatched libc, a stack-smashing bug in a custom build, or exotic musl/uClibc platforms. Almost always a 'can't happen' defensive branch that aborts the rootless re-exec child with _exit(EXIT_FAILURE).

Related errors

• cannot sigdelset(SIGTERM): %m\n
• cannot block signals: %m\n
• cannot read argv: %m
• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/fc8befa92aced0f7. Report an issue: GitHub.